#!/usr/bin/perl -w
#
# Converts tcpdump or wireshark capture
# from pcap format into mpeg video file
# It only converts packets from multicast adresses
# Usage: pcap2mpeg.pl -l LOGFILE -o OUTPUTFILE

use strict;
use Net::TcpDumpLog;
use NetPacket::IP;
use NetPacket::UDP qw(:strip);
use Getopt::Long;

my $outfile = '';
my $logfile = '';

GetOptions( 'l|logfile=s' => \$logfile, 'o|outfile=s' => \$outfile, );
die "Usage: pcap2mpeg.pl -l LOGFILE -o OUTFILE"
  unless ( defined $logfile && defined $outfile );

open OUT, ">>$outfile" or die "Can not open $outfile $!\n";

my $log = Net::TcpDumpLog->new();
$log->read("$logfile");
my @Indexes = $log->indexes;

foreach my $index (@Indexes) {
    my ( $length_orig, $length_incl, $drops, $secs, $msecs ) = $log->header($index);
    my $data = $log->data($index);
    my ( $ether_dest, $ether_src, $ether_type, $ether_data ) = unpack( 'H12H12H4a*', $data );
    my $ip_obj   = NetPacket::IP->decode($ether_data);
    my @bytes_ip = split /\./, ( $ip_obj->{dest_ip} );
    my $udp_obj  = NetPacket::UDP->decode( $ip_obj->{data} );
    if ( $bytes_ip[0] >= 224 and $bytes_ip[0] <= 240 ){    # only extract data from multicast addresses
        my $data_neu = $udp_obj->{data};
        print OUT $data_neu;
    }
}